CVE-2026-46522: ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

Synopsis

An infinite loop vulnerability in the ImageMagick MIFF image decoder allows a remote, unauthenticated attacker to exhaust CPU resources by submitting a crafted image file. The flaw is reachable over the network with no privileges or user interaction required, making it straightforward to trigger against any service that processes untrusted images through ImageMagick. Successful exploitation causes a denial of service by pinning CPU usage, rendering the affected process or host unresponsive. No fix versions have been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable decoder is reachable over the network; an attacker must be able to submit a crafted MIFF file to a service that processes it with ImageMagick.

• AuthenticationNot required

  No credentials or account are needed to trigger the infinite loop; any client that can deliver a file to the processing endpoint is sufficient.

• Victim interactionNot required

  The vulnerability triggers during automated image processing with no action required from an end user or operator.

• Attack complexityDetail

  Attack complexity is low; exploitation is reliable and requires no special conditions, race windows, or environmental dependencies beyond delivering the crafted file.

Blast Radius

• The affected ImageMagick worker process enters an infinite loop, consuming all available CPU on the thread handling the request.
• Sustained or repeated submissions of crafted MIFF files can pin CPU utilization and starve other processes running on the same host or container.
• In containerized environments without CPU limits, the exhaustion can spread to neighboring workloads sharing the same node.
• Image processing pipelines that depend on ImageMagick (format conversion, thumbnail generation, metadata extraction) become unavailable for the duration of the attack.